What's New in Windows Filtering Platform

Windows 8 and Windows Server 2012 introduce new Windows Filtering Platform programming elements. New functionality includes the following:

• Layer 2 filtering: Provides access to the L2 (MAC) layer, allowing filtering of traffic at that layer.
• vSwitch filtering: Allows packets traversing a vSwitch to be inspected and/or modified. WFP filters or callouts can be used at the vSwitch ingress and egress.
• App container management: Allows access to information about app containers and network isolation connectivity issues.
• IPsec updates: Extended IPsec functionality including connection state monitoring, certificate selection, and key management.

The Windows Driver Kit also includes information on WFP Changes for Windows 8.

Windows 8 API updates

Many new APIs have been added for Windows 8 and Windows Server 2012.

New functions

• FWPM_NET_EVENT_CALLBACK1
• FwpmConnectionCreateEnumHandle0
• FwpmConnectionDestroyEnumHandle0
• FwpmConnectionEnum0
• FwpmConnectionGetById0
• FwpmConnectionGetSecurityInfo0
• FwpmConnectionSetSecurityInfo0
• FwpmConnectionSubscribe0
• FwpmConnectionSubscriptionsGet0
• FwpmConnectionUnsubscribe0
• FwpmIPsecTunnelAdd2
• FwpmNetEventEnum2
• FwpmNetEventSubscribe1
• FwpmProviderContextAdd2
• FwpmProviderContextEnum2
• FwpmProviderContextGetById2
• FwpmProviderContextGetByKey2
• FwpmvSwitchEventsGetSecurityInfo0
• FwpmvSwitchEventsSetSecurityInfo0
• FwpmvSwitchEventSubscribe0
• FwpmvSwitchEventUnsubscribe0
• IkeextSaEnum2
• IkeextSaGetById2
• IPSEC_KEY_MANAGER_KEY_DICTATION_CHECK0
• IPSEC_KEY_MANAGER_DICTATE_KEY0
• IPSEC_KEY_MANAGER_NOTIFY_KEY0
• IPSEC_SA_CONTEXT_CALLBACK0
• IPsecKeyManagerAddAndRegister0
• IPsecKeyManagerGetSecurityInfoByKey0
• IPsecKeyManagerSetSecurityInfoByKey0
• IPsecKeyManagersGet0
• IPsecKeyManagerUnregisterAndDelete0
• IPsecSaContextSubscribe0
• IPsecSaContextSubscriptionsGet0
• IPsecSaContextUnsubscribe0
• NetworkIsolationDiagnoseConnectFailureAndGetInfo
• NetworkIsolationEnumAppContainers
• NetworkIsolationEnumerateAppContainerRules
• NetworkIsolationFreeAppContainers
• NetworkIsolationGetAppContainerConfig
• NetworkIsolationRegisterForAppContainerChanges
• NetworkIsolationSetAppContainerConfig
• NetworkIsolationSetupAppContainerBinaries
• PAC_CHANGES_CALLBACK_FN

New structures

• IKEEXT_AUTHENTICATION_METHOD2
• IKEEXT_CERT_EKUS0
• IKEEXT_CERT_NAME0
• IKEEXT_CERTIFICATE_AUTHENTICATION2
• IKEEXT_CERTIFICATE_CRITERIA0
• IKEEXT_EM_POLICY2
• IKEEXT_KERBEROS_AUTHENTICATION1
• IKEEXT_POLICY2
• IPSEC_KEY_MANAGER0
• IPSEC_KEY_MANAGER_CALLBACKS0
• IPSEC_KEYING_POLICY1
• IPSEC_SA_CONTEXT_CHANGE0
• IPSEC_SA_CONTEXT_SUBSCRIPTION0
• IPSEC_TRANSPORT_POLICY2
• IPSEC_TUNNEL_ENDPOINT0
• IPSEC_TUNNEL_ENDPOINTS2
• IPSEC_TUNNEL_POLICY2
• FWPM_CONNECTION0
• FWPM_CONNECTION_ENUM_TEMPLATE0
• FWPM_CONNECTION_SUBSCRIPTION0
• FWPM_NET_EVENT2
• FWPM_NET_EVENT_CAPABILITY_ALLOW0
• FWPM_NET_EVENT_CAPABILITY_DROP0
• FWPM_NET_EVENT_CLASSIFY_ALLOW0
• FWPM_NET_EVENT_CLASSIFY_DROP2
• FWPM_NET_EVENT_CLASSIFY_DROP_MAC0
• FWPM_NET_EVENT_HEADER2
• FWPM_PROVIDER_CONTEXT2
• FWPM_VSWITCH_EVENT0
• FWPM_VSWITCH_EVENT_SUBSCRIPTION0

New enumerated types

• FWP_VSWITCH_NETWORK_TYPE
• FWPM_APPC_NETWORK_CAPABILITY_TYPE
• FWPM_CONNECTION_EVENT_TYPE
• FWPM_VSWITCH_EVENT_TYPE
• IKEEXT_CERT_CRITERIA_NAME_TYPE
• IPSEC_SA_CONTEXT_EVENT_TYPE0

New filtering layer identifiers

Filtering Layer Identifiers:

• FWPM_LAYER_INBOUND_MAC_FRAME_ETHERNET
• FWPM_LAYER_OUTBOUND_MAC_FRAME_ETHERNET
• FWPM_LAYER_INBOUND_MAC_FRAME_NATIVE
• FWPM_LAYER_OUTBOUND_MAC_FRAME_NATIVE
• FWPM_LAYER_INGRESS_VSWITCH_ETHERNET
• FWPM_LAYER_EGRESS_VSWITCH_ETHERNET
• FWPM_LAYER_INGRESS_VSWITCH_TRANSPORT_V4 / FWPM_LAYER_INGRESS_VSWITCH_TRANSPORT_V6
• FWPM_LAYER_EGRESS_VSWITCH_TRANSPORT_V4 / FWPM_LAYER_EGRESS_VSWITCH_TRANSPORT_V6

New filtering condition identifiers

Filtering Condition Identifiers:

• FWPM_CONDITION_INTERFACE_MAC_ADDRESS
• FWPM_CONDITION_MAC_LOCAL_ADDRESS
• FWPM_CONDITION_MAC_REMOTE_ADDRESS
• FWPM_CONDITION_ETHER_TYPE
• FWPM_CONDITION_VLAN_ID
• FWPM_CONDITION_NDIS_PORT
• FWPM_CONDITION_NDIS_MEDIA_TYPE
• FWPM_CONDITION_NDIS_PHYSICAL_MEDIA_TYPE
• FWPM_CONDITION_L2_FLAGS
• FWPM_CONDITION_MAC_LOCAL_ADDRESS_TYPE
• FWPM_CONDITION_MAC_REMOTE_ADDRESS_TYPE
• FWPM_CONDITION_ALE_PACKAGE_ID
• FWPM_CONDITION_MAC_SOURCE_ADDRESS
• FWPM_CONDITION_MAC_DESTINATION_ADDRESS
• FWPM_CONDITION_MAC_SOURCE_ADDRESS_TYPE
• FWPM_CONDITION_MAC_DESTINATION_ADDRESS_TYPE
• FWPM_CONDITION_IP_SOURCE_PORT
• FWPM_CONDITION_IP_DESTINATION_PORT
• FWPM_CONDITION_VSWITCH_ID
• FWPM_CONDITION_VSWITCH_NETWORK_TYPE
• FWPM_CONDITION_VSWITCH_SOURCE_INTERFACE_ID
• FWPM_CONDITION_VSWITCH_DESTINATION_INTERFACE_ID
• FWPM_CONDITION_VSWITCH_SOURCE_VM_ID
• FWPM_CONDITION_VSWITCH_DESTINATION_VM_ID
• FWPM_CONDITION_VSWITCH_SOURCE_INTERFACE_TYPE
• FWPM_CONDITION_VSWITCH_TENANT_NETWORK_ID

New filtering condition flags

Filtering Condition Flags:

• FWP_CONDITION_FLAG_IS_PROXY_CONNECTION
• FWP_CONDITION_FLAG_IS_APPCONTAINER_LOOPBACK
• FWP_CONDITION_FLAG_IS_NON_APPCONTAINER_LOOPBACK
• FWP_CONDITION_FLAG_IS_HONORING_POLICY_AUTHORIZE
• FWP_CONDITION_L2_IS_NATIVE_ETHERNET
• FWP_CONDITION_L2_IS_WIFI
• FWP_CONDITION_L2_IS_MOBILE_BROADBAND
• FWP_CONDITION_L2_IS_WIFI_DIRECT_DATA
• FWP_CONDITION_L2_IS_VM2VM
• FWP_CONDITION_L2_IS_MALFORMED_PACKET
• FWP_CONDITION_L2_IS_IP_FRAGMENT_GROUP
• FWP_CONDITION_L2_IF_CONNECTOR_PRESENT

Windows 7 updates to the Windows Filtering Platform

The document What's New in Windows Filtering Platform details many of the updates made for Windows 7. Information is also available in the Windows Driver Kit on WFP Changes for Windows 7.